Privacy Policy

Depending on how you use ClearTerm, we may process the following categories of data:

• Account data (email, user ID) when you sign up or sign in (Firebase Auth).
• Contract files (PDF) and extracted text for analysis (server-side processing).
• Analysis/result metadata (e.g., score, summary) if stored.
• Usage and security data (e.g., IP/header-derived identifiers) for abuse prevention (rate limiting).
• Billing/subscription metadata (e.g., Stripe customer/subscription IDs) if you upgrade to Pro.

• Provide and operate the service (scan, diff, UI).
• Security, abuse prevention, and rate limiting.
• Account and subscription management.
• Debugging and service improvement.

• Art. 6(1)(b) - performance of a contract (providing the service).
• Art. 6(1)(f) - legitimate interests (security, abuse prevention, reliability).
• Art. 6(1)(a) - consent (only if optional cookies/analytics are enabled).
• Art. 6(1)(c) - legal obligation (e.g., tax/accounting duties for payments).

We use the following providers (as applicable):

• Vercel - Application hosting, deployment and server functions.
• Firebase (Google) - Authentication and database (Firestore) for user/subscription metadata.
• Stripe - Payments and subscription management (we do not store full card details).
• Google Gemini - AI analysis of contract content you provide.
• Resend - Transactional email delivery — one-time login codes, and the name, email address and message you submit through the contact form.

Depending on the provider, data may be processed outside the EU/EEA (e.g., in the United States). Where applicable, we rely on appropriate safeguards (e.g., Standard Contractual Clauses where available) and/or relevant certifications/frameworks of providers.

Uploaded PDFs and the text extracted from them are not retained in ClearTerm's own storage — they are processed in memory to produce the analysis and not written to our database or file storage. Everything else is kept for the periods below, which are enforced automatically. Expiry usually completes within about a day of the deadline.

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact us using the details in Section 1. Where we rely on your consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen (https://www.datenschutz.bremen.de). You may also complain to the supervisory authority where you live or work.

ClearTerm uses only necessary cookies where required. Optional analytics/marketing cookies are used only with consent (if enabled).

We may update this Privacy Policy as our service or legal requirements change.